The mask field limits permissions assigned by acl. For example, if a file's unix mode is -rw-------, the mask is set to r-- (set with m::r), and another user has rw- set by ACL, the effective permissions for the other user will be r-- because of the r-- mask. The owner will retain the rw- permissions as the mask doesn't affect the normal unix permissions.